Analysis
-
max time kernel
149s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 22:52
Behavioral task
behavioral1
Sample
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
063f9dd5557a4e41ca25807029e61906
-
SHA1
faed520fba9a03c18844fb6b15d261caabd2855d
-
SHA256
4d6ed356850fd777abd66d263bf6bcfc51a5619042fcee8f10bf28bce45e5024
-
SHA512
3f3bbd163e64e142b6da1bc83527a40802503e6cf005ba78896d5dcbf9f615bae37f93fd22415f14f6c24f8f1da972299a9df876a42ad67ed5ea6bb887f240d0
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWww/
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
Processes:
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exepid process 732 explorer.exe 3516 explorer.exe 4080 spoolsv.exe 1920 spoolsv.exe 4832 spoolsv.exe 1988 spoolsv.exe 4736 spoolsv.exe 1488 spoolsv.exe 4320 spoolsv.exe 4060 spoolsv.exe 2972 spoolsv.exe 624 spoolsv.exe 3904 spoolsv.exe 3312 spoolsv.exe 4868 spoolsv.exe 3916 spoolsv.exe 1564 spoolsv.exe 228 spoolsv.exe 3796 spoolsv.exe 4820 spoolsv.exe 1208 spoolsv.exe 4368 spoolsv.exe 3984 spoolsv.exe 3920 spoolsv.exe 4676 spoolsv.exe 1472 spoolsv.exe 4084 spoolsv.exe 3756 spoolsv.exe 2200 spoolsv.exe 1932 spoolsv.exe 4724 spoolsv.exe 4500 spoolsv.exe 3564 spoolsv.exe 3352 explorer.exe 4360 spoolsv.exe 3944 spoolsv.exe 764 spoolsv.exe 4376 spoolsv.exe 3248 spoolsv.exe 3452 explorer.exe 4472 spoolsv.exe 2528 spoolsv.exe 4620 spoolsv.exe 2272 spoolsv.exe 376 spoolsv.exe 4228 explorer.exe 4316 spoolsv.exe 2748 spoolsv.exe 3884 spoolsv.exe 640 spoolsv.exe 4860 spoolsv.exe 4472 spoolsv.exe 3604 explorer.exe 2344 spoolsv.exe 4056 spoolsv.exe 5008 spoolsv.exe 3088 spoolsv.exe 3976 spoolsv.exe 968 spoolsv.exe 4236 spoolsv.exe 988 explorer.exe 1440 spoolsv.exe 1608 spoolsv.exe 3948 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 52 IoCs
Processes:
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 1648 set thread context of 972 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe PID 732 set thread context of 3516 732 explorer.exe explorer.exe PID 4080 set thread context of 3564 4080 spoolsv.exe spoolsv.exe PID 1920 set thread context of 4360 1920 spoolsv.exe spoolsv.exe PID 4832 set thread context of 3944 4832 spoolsv.exe spoolsv.exe PID 1988 set thread context of 4376 1988 spoolsv.exe spoolsv.exe PID 4736 set thread context of 3248 4736 spoolsv.exe spoolsv.exe PID 1488 set thread context of 4472 1488 spoolsv.exe spoolsv.exe PID 4320 set thread context of 2528 4320 spoolsv.exe spoolsv.exe PID 4060 set thread context of 4620 4060 spoolsv.exe spoolsv.exe PID 2972 set thread context of 376 2972 spoolsv.exe spoolsv.exe PID 624 set thread context of 4316 624 spoolsv.exe spoolsv.exe PID 3904 set thread context of 2748 3904 spoolsv.exe spoolsv.exe PID 3312 set thread context of 3884 3312 spoolsv.exe spoolsv.exe PID 4868 set thread context of 4860 4868 spoolsv.exe spoolsv.exe PID 3916 set thread context of 4472 3916 spoolsv.exe spoolsv.exe PID 1564 set thread context of 2344 1564 spoolsv.exe spoolsv.exe PID 228 set thread context of 4056 228 spoolsv.exe spoolsv.exe PID 3796 set thread context of 5008 3796 spoolsv.exe spoolsv.exe PID 4820 set thread context of 3088 4820 spoolsv.exe spoolsv.exe PID 1208 set thread context of 968 1208 spoolsv.exe spoolsv.exe PID 4368 set thread context of 4236 4368 spoolsv.exe spoolsv.exe PID 3984 set thread context of 1440 3984 spoolsv.exe spoolsv.exe PID 3920 set thread context of 1608 3920 spoolsv.exe spoolsv.exe PID 4676 set thread context of 3948 4676 spoolsv.exe spoolsv.exe PID 1472 set thread context of 4276 1472 spoolsv.exe spoolsv.exe PID 4084 set thread context of 724 4084 spoolsv.exe spoolsv.exe PID 3756 set thread context of 2204 3756 spoolsv.exe spoolsv.exe PID 2200 set thread context of 1104 2200 spoolsv.exe spoolsv.exe PID 1932 set thread context of 3784 1932 spoolsv.exe spoolsv.exe PID 4724 set thread context of 4564 4724 spoolsv.exe spoolsv.exe PID 4500 set thread context of 1320 4500 spoolsv.exe spoolsv.exe PID 3352 set thread context of 3456 3352 explorer.exe explorer.exe PID 764 set thread context of 4592 764 spoolsv.exe spoolsv.exe PID 3452 set thread context of 716 3452 explorer.exe explorer.exe PID 2272 set thread context of 4448 2272 spoolsv.exe spoolsv.exe PID 4228 set thread context of 1372 4228 explorer.exe explorer.exe PID 640 set thread context of 2744 640 spoolsv.exe spoolsv.exe PID 3604 set thread context of 4532 3604 explorer.exe explorer.exe PID 3976 set thread context of 884 3976 spoolsv.exe spoolsv.exe PID 988 set thread context of 4212 988 explorer.exe explorer.exe PID 2172 set thread context of 4764 2172 spoolsv.exe spoolsv.exe PID 3032 set thread context of 1156 3032 explorer.exe explorer.exe PID 1408 set thread context of 3644 1408 spoolsv.exe spoolsv.exe PID 4924 set thread context of 1880 4924 spoolsv.exe spoolsv.exe PID 3124 set thread context of 1908 3124 explorer.exe explorer.exe PID 540 set thread context of 3224 540 spoolsv.exe spoolsv.exe PID 3720 set thread context of 3252 3720 spoolsv.exe spoolsv.exe PID 4040 set thread context of 3416 4040 spoolsv.exe spoolsv.exe PID 5100 set thread context of 5056 5100 explorer.exe explorer.exe PID 696 set thread context of 4896 696 spoolsv.exe spoolsv.exe PID 5032 set thread context of 4956 5032 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exeexplorer.exepid process 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 3516 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3516 explorer.exe 3564 spoolsv.exe 3564 spoolsv.exe 4360 spoolsv.exe 4360 spoolsv.exe 3944 spoolsv.exe 3944 spoolsv.exe 4376 spoolsv.exe 4376 spoolsv.exe 3248 spoolsv.exe 3248 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 2528 spoolsv.exe 2528 spoolsv.exe 4620 spoolsv.exe 4620 spoolsv.exe 376 spoolsv.exe 376 spoolsv.exe 4316 spoolsv.exe 4316 spoolsv.exe 2748 spoolsv.exe 2748 spoolsv.exe 3884 spoolsv.exe 3884 spoolsv.exe 4860 spoolsv.exe 4860 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 2344 spoolsv.exe 2344 spoolsv.exe 4056 spoolsv.exe 4056 spoolsv.exe 5008 spoolsv.exe 5008 spoolsv.exe 3088 spoolsv.exe 3088 spoolsv.exe 968 spoolsv.exe 968 spoolsv.exe 4236 spoolsv.exe 4236 spoolsv.exe 1440 spoolsv.exe 1440 spoolsv.exe 1608 spoolsv.exe 1608 spoolsv.exe 3948 spoolsv.exe 3948 spoolsv.exe 4276 spoolsv.exe 4276 spoolsv.exe 724 spoolsv.exe 724 spoolsv.exe 2204 spoolsv.exe 2204 spoolsv.exe 1104 spoolsv.exe 1104 spoolsv.exe 3784 spoolsv.exe 3784 spoolsv.exe 4564 spoolsv.exe 4564 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1648 wrote to memory of 3084 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe splwow64.exe PID 1648 wrote to memory of 3084 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe splwow64.exe PID 1648 wrote to memory of 972 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe PID 1648 wrote to memory of 972 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe PID 1648 wrote to memory of 972 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe PID 1648 wrote to memory of 972 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe PID 1648 wrote to memory of 972 1648 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe PID 972 wrote to memory of 732 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe explorer.exe PID 972 wrote to memory of 732 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe explorer.exe PID 972 wrote to memory of 732 972 063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe explorer.exe PID 732 wrote to memory of 3516 732 explorer.exe explorer.exe PID 732 wrote to memory of 3516 732 explorer.exe explorer.exe PID 732 wrote to memory of 3516 732 explorer.exe explorer.exe PID 732 wrote to memory of 3516 732 explorer.exe explorer.exe PID 732 wrote to memory of 3516 732 explorer.exe explorer.exe PID 3516 wrote to memory of 4080 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4080 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4080 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1920 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1920 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1920 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4832 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4832 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4832 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1988 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1988 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1988 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4736 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4736 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4736 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1488 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1488 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1488 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4320 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4320 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4320 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4060 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4060 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4060 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 2972 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 2972 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 2972 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 624 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 624 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 624 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3904 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3904 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3904 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3312 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3312 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3312 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4868 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4868 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 4868 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3916 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3916 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3916 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1564 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1564 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 1564 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 228 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 228 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 228 3516 explorer.exe spoolsv.exe PID 3516 wrote to memory of 3796 3516 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\063f9dd5557a4e41ca25807029e61906_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5dbf4aeed37b0d3a39fc13abeeb84c98d
SHA1878c5462ba247ab484e84ced516a401a33b365d7
SHA256ac975fcc6ac79cc636e1c5959fd41c5ce1b5b743d38243f224953142891402f5
SHA512d13a267cdee8c08c75a4046f7aa60a2fb319ed0c297cab0f3f968909c93e6657bcbeffd29ad7393f83db09eb7d6210ed94416bea2cf994df61586ea46d7802d1
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD53f4b156bedf4ebd2018651401c58fb06
SHA168cf32f11a9171e0df3acc83543a1f1d28946664
SHA25669bc63670561ed8bcefcf545c2441775e922dba664872b02003db5f19417c9e8
SHA512d761238af586466d8db6d1d55b1772e7d7f14ee9d516cb31c0c13d34c46b75e4a143d0024bc21b659274219445c460f05d18258d1729d5d28b86f36aeba9d1fe
-
memory/228-1775-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/376-2271-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/624-1470-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/716-3419-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/724-2715-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/732-90-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/732-85-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/884-4452-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/884-4561-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/968-2584-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/972-79-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/972-47-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/972-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1104-2887-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1104-3034-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1156-4659-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1208-1920-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1320-3104-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1320-3253-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1372-3762-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1440-2675-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1488-1139-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1492-5159-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1564-1774-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-2687-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1648-48-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1648-43-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/1648-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1648-0-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/1880-4776-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1880-4929-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1908-4787-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1920-1935-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1920-996-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1988-998-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1988-2030-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2204-2799-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2204-2794-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2344-2458-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2744-4076-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2748-2291-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2972-1307-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3088-2490-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3088-2487-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3248-2107-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3248-2251-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3252-4886-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3252-4873-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3312-1472-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3416-5026-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3416-5124-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3456-3127-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3456-3155-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3516-89-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3516-829-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3564-1921-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3564-2095-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3644-4672-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3644-4667-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3784-2897-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3796-1776-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3904-1471-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3916-1622-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3944-1946-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3948-2693-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3948-2698-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3984-1945-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4056-2470-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4060-1306-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4080-830-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4080-1922-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4212-4463-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4236-2667-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4276-2706-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4316-2279-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-1305-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4360-1932-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4360-1934-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4360-1931-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4368-1928-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4448-3666-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4472-2648-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4472-2450-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4472-2115-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4472-2118-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4532-4087-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4564-2936-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4564-2927-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4592-3394-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4620-2137-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4736-1138-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4764-4755-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4764-4649-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4820-1919-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4832-997-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4832-1940-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4860-2364-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4868-1621-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4956-5054-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5008-2481-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5056-5037-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB